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Abstract. A Quantum Key Distribution (QKD) network is an infrastructure that 
allows the realization of the key distribution cryptographic primitive over long distances 
and at high rates with information-theoretic security. In this work, we consider QKD 
networks based on trusted repeaters from a topology viewpoint, and present a set of 
analytical models that can be used to optimize the spatial distribution of QKD devices 
and nodes in specific network configurations in order to guarantee a certain level of 
service to network users, at a minimum cost. We give details on new methods and 
original results regarding such cost minimization arguments applied to QKD networks. 
These results are likely to become of high importance when the deployment of QKD 
networks will be addressed by future quantum telecommunication operators. They will 
therefore have a strong impact on the design and requirements of the next generation 
of QKD devices. 
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1. Introduction 

Quantum Key Distribution (QKD) is a technology that uses the properties of quantum 
mechanics to realize an important cryptographic primitive: key distribution 0. Unlike 
the techniques used in traditional "classical" cryptography, for which the security relies 
on the conjectured computational hardness of certain mathematical problems, QKD 
security can be formally proven. Secret keys established via QKD are information- 
theoretically secure, which implies that any adversary trying to eavesdrop cannot obtain 
any information on the transmitted keys at any point in the future, even if she possesses 
extremely large computational resources. 

The communication channels needed to perform QKD consist in an optical channel, 
on which well-controlled quantum states of light are exchanged, and a classical channel 
that is used for signaling during the quantum exchanges and for the classical post- 
processing phase, namely key reconciliation. Their combination forms a communication 
link, over which quantum key distribution allows two distant users to exchange a 
specific type of data, in particular secret keys. In this sense, QKD is by nature a 
telecommunication technology, and so QKD links can be combined with appropriately 
designed nodes to form QKD networks. 

The performance of QKD links has rapidly improved in the last years. Starting 
from pioneering experiments in the 90s pQ, important steps have been taken to bring 
QKD from the laboratory to the open field. Thanks to the continuous efforts invested 
in developing better QKD protocols and hardware, in parallel to the advancement of 
security proofs (see [2j[3lll] for reviews), the performance that can now be achieved, in 
terms of attainable communication distance, secret key generation rate and reliability, 
positions QKD as the first quantum information processing technology reaching a level 
of maturity sufficient to target deployment over real-world networks. Indeed, off-the- 
shelf QKD systems are now commercially available [5] , and the first QKD networks have 
recently been implemented [SI E] • 

Up till now, research in QKD has focused on building and optimizing individual 
systems to reach the longest possible distance and/or the highest possible secret bit rate, 
without taking into account the cost of such systems. However, as the perspective of 
deploying QKD networks becomes a reality, the question of optimal resource allocation, 
intrinsically linked to cost considerations, becomes relevant and important, as is the 
case for any telecommunication network infrastructure. It becomes therefore necessary 
to consider QKD from a cost perspective, and in particular study the potential trade-offs 
of cost and performance that can occur in this context. 

Following the above arguments, we consider in this work the design of QKD 
networks from a topology viewpoint, and present techniques and analytical models that 
can be used to optimize the spatial distribution of QKD devices and QKD nodes within 
specific network architectures in order to guarantee a given level of service to the network 

J More accurately, the primitive is that of secret key agreement using a public quantum channel and 
a public authenticated classical channel. 
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users, at a minimum cost. We also study how cost minimization arguments influence the 
optimal working points of QKD links. We show in particular that, in the perspective 
of QKD networks, individual QKD links should be operated at an optimal working 
distance that can be significantly shorter than their maximum attainable distance. 

The paper is structured as follows. In section [2} we define a QKD network and 
discuss the topology and characteristics of the network architecture that we consider in 
this work. We also introduce the concept of a backbone network structure. In section [31 
we present our calculations and results on network topological optimization based on 
cost arguments. In particular, we provide a comprehensive set of modeling tools and 
cost function calculations in specific network configurations, and discuss the effect of 
our results on the design of practical QKD networks. Finally, in section HI we discuss 
open questions and future perspectives for QKD networks. 

2. QKD networks 

Definition and types of QKD networks 

Extending the range of quantum key distribution systems to very long distances, and 
allowing the exchange of secret keys between multiple users necessitates the development 
of a network infrastructure connecting multiple individual QKD links. Indeed, QKD 
links are inherently only adapted to point-to-point key exchange between the two 
endpoints of a quantum channel, while the signal-to-noise ratio decrease occurring with 
propagation loss ultimately limits their attainable range. It is then natural to consider 
QKD networks as a means to overcome these limitations. 

A QKD network is an infrastructure composed of QKD links, i.e. pairs of QKD 
devices linked by a quantum and a classical communication channel connecting two 
separate locations, or nodes. These links are then used to connect multiple distant 
nodes. Based on these resources and using appropriate protocols, this infrastructure 
can enable the unconditionally secure distribution of symmetric secret keys between 
any pair of legitimate users accessing the network. 

QKD networks can be categorized in two general groups [9]: networks that cre- 
ate an end-to-end quantum channel between the two users, and networks that require 
a transport of the key over many intermediate trusted nodes. In the first group, we 
find networks in which a classical optical function such as switching or multiplexing is 
applied at the node level on the quantum signals sent over the quantum channel. This 
approach allows multi-user QKD but cannot be used to extend the key distribution 
distance. Much more advanced members of this group are the quantum repeater based 
QKD networks. Quantum repeaters [10] can create a perfect end-to-end quantum chan- 
nel by distributing entanglement between any two network users. The implementation 
of quantum repeaters, however, requires complex quantum operations and quantum 
memories, whose realization remains an experimental challenge. The same is true for 
the simpler version of quantum repeaters, namely quantum relays [TTJ, which on the 
one hand do not require a quantum memory but on the other cannot arbitrarily extend 
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the QKD communication distance. 

Trusted repeater QKD networks: characteristics and assumptions 

In this work, we are interested in the second group of networks, which we call trusted 
repeater QKD networks. In these networks, the nodes act as trusted relays that store 
locally QKD-generated keys in classical memories, and then use these keys to perform 
long-distance key distribution between any two nodes of the network. Therefore, 
trusted repeater QKD networks do not require nodes equipped with quantum memories; 
they only require QKD devices and classical memories as well as processing units 
placed within secure locations, and can thus be deployed with currently available 
technologies. Indeed, the implementation of such networks has been the subject of 
several international projects (TJ [HI EEJ H3]- 

As we will see in detail in the following section, the analysis of trusted repeater 
QKD networks from a topology viewpoint and with the goal of achieving optimization 
based on cost considerations involves modeling several characteristics of such a network, 
namely the user distribution, the node distribution, the call traffic, and the traffic 
routing. The user and node distributions, denoted by II and M respectively, will 
be considered as Poisson stochastic point processes, and will be thus modeled using 
convenient stochastic geometry tools. Modeling the traffic demand is particularly subtle 
because of the variation with respect to time and distance that this traffic may feature 
in a real network. Calculations here will neglect these variations and will be performed 
under the assumption of a uniform call volume between any pair of users, denoted as 
V. 

Finally, routing in trusted repeater QKD networks is performed according to the 
following general principle: First, local keys are generated over QKD links and are 
stored in nodes that are placed on both ends of each link. Global key distribution is 
then performed over a QKD path, i.e. a one-dimensional chain of trusted relays con- 
nected by QKD links, establishing a connection between two end nodes. Secret keys are 
forwarded, in a hop-by-hop fashion, along these QKD paths. To ensure their secrecy, 
one-time pad encryption and information-theoretically secure authentication, both re- 
alized with a local QKD key, are performed. End-to-end information-theoretic security 
is thus obtained between the end nodes, provided that the intermediate nodes can be 
trusted. 

Quantum backbone network architecture 

Introducing hierarchy into network design can be an extremely convenient architectural 
tool because it allows to break complex structures into smaller and more flexible 
ensembles. Indeed, such hierarchical levels offer an efficient way to help solve resource 
allocation problems arising in networks, ranging from network routing to network 
deployment planning. In this work, we will associate the notion of hierarchy in QKD 
networks with the existence of what we will call a quantum backbone network. 

In classical networks and especially the Internet, a backbone line is a larger 
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transmission line that carries data gathered from smaller lines that interconnect with 
it. By analogy with this definition, the backbone QKD network is an infrastructure for 
key transport that gathers the traffic of secret key from many individual QKD links. 
QKD backbone links and nodes clearly appear as mutualized resources shared to provide 
service to many pairs of users. Keeping the fruitful analogy with classical networks, we 
will call access QKD links the point-to-point links used to connect QKD end users to 
their nearest QKD backbone node. 

The principle of traffic routing that we described above can be conveniently trans- 
posed in the context of backbone networks. In this case, traffic from individual users is 
gathered locally to backbone QKD nodes. This mutualized traffic is then routed hop- 
by-hop over the backbone structure. Furthermore, it is important to note that the node 
and user point process distributions are distinct when a backbone network is considered, 
which might not be the case in a network without backbone. 

In the following, we will derive cost functions for different QKD network 
configurations, under the above assumptions regarding the topology and the way traffic 
is routed in these networks, and as a function of the characteristics of individual QKD 
links. We will then use the results to discuss how QKD networks should be dimensioned, 
the optimal working points of QKD links, as well as the interest of adopting a hierarchical 
architecture, materialized by the existence of a backbone, in QKD networks. 

3. Topological optimization based on cost arguments 

3.1. QKD links: characterizing the rate versus distance 

The main element underlying the cost optimization related to the deployment of 
quantum networks is the intrinsic performance of QKD links. This performance can 
essentially be summarized by the function R(£), which gives the rate, in bit/s, of secret 
key that can be established over a QKD link of length £. 

Clearly, this secret key bit rate varies from system to system and comparisons 
between systems are thus difficult to establish. Moreover, comparisons have to be 
related to the security proofs for which the secret key bit rates have been derived. 
Security proofs are not yet fully categorized, although important steps in this direction 
have been taken [I]. 

As shown on figured], the typical curve describing the variation with distance of the 
logarithm of the mean rate of secret bit establishment R(£) can be essentially separated 
into two parts: 

• A linear part that is the region where the rate of secret key establishment varies 
as a given power of the propagation attenuation. Since the attenuation r](£) is 
exponentially increasing with distance, log R(£) is linear in I. 

• An exponential drop-off at longer distances, where the error rate rapidly 
increases due to the growing contribution of detection dark counts. In this region, 
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Figure 1. Typical profile of the Rate versus Distance curve for a single QKD link. 

the decrease of the secret key rate is multi-exponential with distance. The slope of 
the curve representing log R(l) is thus becoming increasingly steep until a maximum 
distance is reached. 

For completeness, it is also important to mention the possibility that, for short 
distances, the secret bit rate could be limited by a saturation of the detection setup. 
This will be the case if the repetition rate at which the quantum signals are sent in 
the quantum channel exceeds the bandwidth of the detector. We will however not 
investigate this possibility any further in the remaining of this work. 

The behavior of the secret bit rate function R(£) can be described using essentially 
three parameters, schematically shown on figure [TJ 

(i) The secret bit rate at zero distance, Ro; 

(ii) The scaling parameter A QKD in the linear region such that R(£) = i2 e-^ A Q KD ; 

(iii) The distance at which the scaling of the rate becomes exponential, which is 
comparable to the maximum attainable distance, -D drop ~ -D max . 

Ro is determined by the maximum clock rate of the QKD system. In QKD relying 
on photon-counting detection setups, R is limited by the performance of the detectors, 
and is usually in the Mbit/s range. Clearly, the solutions allowing to improve the 
performance of the detectors have a direct impact on R [151 HS1 E]. For QKD 
systems relying on continuous variables [18], based on homodyne detection performed 
with fast photodiodes, the experimental bound on Ro can be significantly higher, 
potentially in the Gbit/s range. The computational complexity of the reconciliation 
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however currently limits Rq in the Mbit/s range in the practical demonstrations 
performed so far |19j . 

The scaling parameter A QK d is essentially determined by the attenuation rj(£) over a 
quantum channel of length £, and by a coefficient r that is mainly related to the security 
proof that can be applied to the experimental system. In the case of a typical network 
based on optical fibers, the attenuation rj(£) can be parametrized by an attenuation 
coefficient a (in dB/km) as r/(£) = lQ~ ai / 10 (for scaling of the attenuation in free space, 
see [1]). In the linear part of the curve shown on figured], the rate R{£) varies as a given 
power r of the attenuation, R(£) = Ror)(£) r . We can thus define the scaling parameter 
as Aqkd = 10/ (a r log(10)). For QKD performed at telecom wavelengths, with protocols 
optimized for long distance operation, we can take a = 0.22 dB/km and r = 1, which 
leads us to Aq KD = 19.7 km, as the typical scaling distance for such QKD systems. 
This parameter is important since, as we shall see in the following, the optimal working 
distance of QKD links will essentially scale as A QKD . 

Finally, the existence of a rapid drop-off of the secret key rate at distances around 
D dIop arises when the probability to detect some signal sent in the quantum channel, p s , 
becomes comparable to the probability to detect a dark count per detection time slot, p d . 
This occurs around the distance D drop , for which we have p s ~ exp(— D drop /A QKD ) x r] d , 
where r\ d represents the detector efficiency. We thus find D Arop ~ A QKD \og(rj d /p d ). In 
practice, when working with InGaAs single-photon avalanche photodiodes (SPADs) 
operating at 1550 nm, the ratio rj d /p d is optimized by varying the different external 
parameters of the detector such as the temperature, gate voltage or time slot duration. 
The best published performances for InGaAs SPADs [201 |2T] report values of the dark 
counts p d ~ 10~ 7 tol0~ 6 for a detection efficiency r\ d around 10%, which leads to 
D dIop ~ -D max ~ 100 — 120 km for QKD systems employing such detectors. For a 
similar detection efficiency, the best available superconducting single-photon detectors 
(SSPDs) present dark counts p d ~ 10~ 8 tol0 -6 [22] , leading to a maximum distance 
that can reach 140 km. 

3.2. Toy model for QKD network cost derivation: a linear chain between two users 

The linear chain as a simple asymptotic model of a quantum backbone network 
As a first example of QKD network cost derivation and optimization, we will consider 
what we will call the linear chain scenario. In particular, we consider two users, A and 
B, that want to rely on QKD to exchange secret keys in a scenario that imposes the use 
of several QKD links: 

• The two QKD users are very far away: their distance is L = \\AB\\ with L -D max . 

• The two QKD users are exchanging secret bits at a very high rate. We will call V 
the volume of calls between the two users A and B (units of V: bits of secret key), 
and will assume V 3> Rq. 

Because of the first condition, many intermediate nodes have to be used as trusted 
key relays to ensure key transport over QKD links from A to B. Because of the second 
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condition, many QKD links have to be deployed in parallel to reach a secret key 
distribution rate capacity at least equal to the traffic volume. 

The linear chain QKD network scenario is in a sense the simplest situation in 
which an infrastructure such as a quantum backbone network, described in section |2j 
is required. It therefore provides an interesting toy model for cost optimization and 
topological considerations. 

Cost model: assumptions and definitions 

The generic purpose of cost optimization is to ensure a given objective in terms of 
service, at the minimum cost. In the case of the linear chain scenario, this objective is 
to be able to offer a secret bit rate of V bit/s between two users A and B separated by 
a distance L, while minimizing the cost of the network infrastructure to be deployed. 

In this and all subsequent models, we will consider as the total cost C of a QKD 
network, the cost of the equipment to be deployed to build the network. This can be seen 
as a simplifying assumption, since it is common, in network planning, to differentiate 
between capital and operating expenditures. We have chosen here to restrict our models 
to capital expenditures of QKD networks and will consider that their cost is arising from 
two sources: 

• The cost of QKD link equipment to be deployed. We will denote as C QKD the 
unit cost per QKD link. C QKD essentially corresponds to the cost of a pair of QKD 
devices. Note that here we implicitly assume that the deployment of optical fibers is 
for free, or more precisely that it is done independently and prior to the deployment 
of a QKD network. 

• The cost of node equipment, which we denote as C nodc . C nodc typically corresponds 
to the hardware cost (for example some specific kind of routers need to be deployed 
inside QKD nodes), as well as the cost of the security infrastructure that is needed 
to make a QKD node a trusted and secure location. 

As explained before and shown on figure [21 a linear chain QKD network is com- 
posed of a one- dimensional chain where adjacent QKD nodes are connected by QKD 
chain segments, each segment being potentially composed of multiple QKD links to en- 
sure that a capacity equal to the traffic volume is reached. 



Alice 



Bob 




Figure 2. The one-dimensional QKD chain linking two QKD users, Alice and Bob, 
over a distance L. Since L is considered much longer than the maximum span of a 
QKD link, -D max , intermediate QKD nodes are needed to serve as trusted relays. 
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Total cost of the linear chain QKD network 

For convexity reasons, discussed in more detail at the end of this section, the topology 
ensuring the minimum cost will correspond to place QKD nodes at regular intervals 
between A and B. We denote by £ the distance between two intermediate nodes, which 
then corresponds to the distance over which QKD links are operated within the linear 
chain QKD network. As we shall see, the question of cost minimization will reduce to 
finding the optimum value of QKD link operational distance, £° pt , for the linear chain 
QKD network. 

There are clearly two antagonistic effects in the dependence of the total cost of the 
considered network on £: 

• On the one hand, if QKD links are operated over long distances, their secret bit 
capacity R(£) decreases. This will impose the deployment of more QKD links in 
parallel, on each chain segment linking two adjacent QKD nodes, and thus tends 
to increase the total cost. 

• On the other hand, it is clear that increasing the operating distance i allows to 
decrease the required number of intermediate trusted relay nodes, which leads to a 
decreased cost. 

The optimum operating distance £° pt corresponds to the value of £ that minimizes 
the total cost function C: 

C = Cqkd Jr(£) + Cn ° dC ~t (1) 
It is important to note that, in the above equation, we have made the assumption 
that we can neglect the effects of discretisation. This means that the length of the chain, 
L, can be considered much longer than the length of individual QKD links, £, and that 
the traffic volume V can be considered as a continuous quantity, neglecting the discrete 
jumps associated to variations in the number of calls. 

Cost minimization and optimum working distance of QKD links 

In the asymptotic limit of very high traffic volume V, the cost of nodes can be neglected 
in comparison with the cost of QKD devices. The expression of the total cost in 
equation (pTJ) then reduces to the first term, and we have the following interesting 
properties: 

• The total cost is directly proportional to the product of the traffic volume V and 
the total distance L. 

• Optimizing the total cost C is equivalent to minimizing C(£)/£ where C{£) = 
C QKD /R(£) is the per-bit cost of one unit of secret key rate. 

Furthermore, assuming that QKD links are operated in the linear part of their 
characteristic (see figured]), we can write C(£) = e iMqkd _ Then, the value of £° pt 
that minimizes the quantity C(£)/£ can be explicitly derived as 

£° pt = A QKD , (2) 
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where A QKD was defined in section 13.11 as the natural scaling parameter of the function 
R(£). 

In the general case, the second term of the cost function in equation (CQ), 
corresponding to the cost of nodes, cannot be neglected. This second term does not 
depend on the volume of traffic V, and is always decreasing with £. As a consequence, 
the optimum operating distance that minimizes C will always be greater than A QKD , the 
value minimizing the first term in equation ([I]). 

Under the assumption that the optimum distance will remain in the linear part of 
the function logR(£), we can derive the following implicit relation for £ opt : 

r pt = A QKD (l + ^^e-^QK D ) (3) 

^ ^QKD V / 

The above equation allows for a quantitative discussion of the "weight" of the nodes 
in the behavior of the cost function. Indeed, we can see that the influence of the node 
cost is potentially important and can lead to an optimum working distance that can be 
significantly greater than A QK d when ^ ^ 3> 1. 

Existence of an optimum working distance and convexity of C (£) 

In most of the explicit derivations performed in this work, we assume a purely 
linear dependency of \ogR(£) on £. This assumption is convenient but remains an 
approximation since it does not take into account the drop-off of R(£) occurring around 

It is however possible to demonstrate the existence of an optimum working distance 
for QKD links in a more general case, by solely relying on the assumption that the 
function R(£) is log-concave, i.e. that \ogR(£) is concave. The log-concavity of R(£) 
can be checked on a simple model inspired by the secret key rate formula for the BB84 
QKD protocol with perfect single photons [I]. In particular, in this case we have 
R(p) = 1 — 2/i(p), where h(p) is the entropy associated to a quantum bit error rate 
p, and assume that the dependence of the error rate p on the distance is of the form 
p = a + b/r](£) = a + b l ^ XQKD , where a and b are parameters linked to the detection 
system. In this setup, it is straightforward to verify numerically that logR(£) is concave 
for all reasonable values of a and b. 

Since C(£), the per-unit cost of secret bit rate on a QKD link, is proportional to 
1/R(£), the log-concavity of R{£) implies the log-convexity of C(£), which itself implies 
the convexity of C{£). Finally, we can write the total cost of the linear chain QKD 
network as the sum of the cost of each chain segment and the cost of the node equipment, 
namely 

n 

C(£ ,...,£ n ) = vY,C(£i)+nC nodc . 

i=0 

In the above equation, £ denotes the distance between A and the first node, £k, 
k = 1, ... n — 1, the distance between the fcth node and the k + 1th node, and £ n 
the distance between the last node and B. For a convex function C, the minimization of 
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^™ =0 C(£j) under the constraint Y^i=o^i = where L is the distance between A and B, 
is obtained with ^ = L/(n+ 1) for all i. Once we set £{ = L/(n + l), the cost expression 
in the above equation only depends on n, or equivalently on £ = L/(n+ 1). For large L, 
we can disregard the fact that I is an integer divider of L and approximate (n + l)/n 
by 1, which then leads to equation (TjQ). 

3.3. Cost of QKD networks: towards more general models 

The linear chain toy model developed in section 13.21 provides an interesting intuition 
into the behavior of the cost function. The most important result is that, in the limit of 
large traffic rates and/or low cost of QKD nodes, the QKD network cost optimization 
reduces to the minimization of C(£)/£ ~ 1/(R(£)£). This leads to the existence of an 
optimum working distance, £ opt , at which QKD links need to be operated in order to 
minimize the global cost of the network deployment. 

The linear chain QKD network model is however too restrictive in many aspects: 
it is one-dimensional and limited to the description of a network providing service to 
two users. We will now consider more general models, which allow us to study the more 
realistic case of QKD networks spanning a two-dimensional area, and providing service 
to a large number of users. 

Modeling network spatial processes with stochastic geometry 

Stochastic geometry is a very useful mathematical tool for modeling telecommunication 
networks. It has the advantage of being able to describe the essential spatial 
characteristics of a network using a small number of parameters [23]. It thus allows 
to study some general characteristics of a given network, like the behavior of its cost 
function, under a restricted set of assumptions. This approach fits well with the 
objectives of this work, and so we have employed stochastic tools to model a QKD 
backbone network. 

As we shall see, instead of calculating the cost of a QKD network for fixed topologies 
and traffic usage, we will try to understand the general behavior of the cost function 
by calculating the average cost function, where the average will be taken over some 
probability distributions of spatial processes modeling QKD users and QKD node 
locations. 

The collection of spatial locations of the QKD nodes over the plane will be repre- 
sented by a spatial point process M = _fAj}. Then, as illustrated in figure [3j we define 
a corresponding partition of the plane |§| as the ensemble of the convex polygons {Di}, 
known as the Vorono'i cells of nucleus {Aj}. Each Voronoi cell Di is constructed by tak- 
ing the intersection of the half-planes bounded by the bisectors of the segment [Aj, Xj] 
and containing Aj. The system of all the cells creates the so-called Voronoi partition. 
Finally, we define the Delaunay graph as the graph, whose vertices are the {A,} and 



§ More accurately, the geometrical object we consider here is a tesselation, the boundaries of which 
are neglected. 
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whose edges are formed by connecting each Voronoi cell nucleus {X;} with the nuclei of 
the adjacent Voronoi cells. 




V 



Figure 3. Thick black lines: Voronoi partition associated to a given distribution of 
nodes. Thin black lines: the Delaunay graph, connecting the center of neighboring 
Voronoi cells. In the backbone QKD network model, backbone QKD links will indeed 
correspond to the Delaunay graph, while backbone nodes correspond to the nucleus of 
the Voronoi cells. We have also represented on the same figure a typical end-to-end 
path, between two QKD users u and v, under the Markov-path routing policy (see text 
in section 13.6.21 for details). 

User distribution and traffic 

In the remaining of this paper, and in contrast to the linear chain toy model developed 
in section I3.2[ we will consider QKD networks providing secret key distribution service 
to a large number of users, distributed over a two-dimensional area. 

The user distribution will be modeled by a Poisson stochastic point process, 
II = {Ui}, defined over the support D of size L x L, while the average number of 
QKD users will be denoted by jj,. The point process IT will also be assumed to have 
an intensity density / satisfying \x = J f < oo, which means that for every set E the 
number of users within E is a Poisson random variable with mean J E f. 

Finally, whenever this additional assumption will prove to be useful to perform the 
desired calculations, we will consider that the distribution of users is homogeneous over 
D, i.e. that the intensity function / is constant over D. We will denote this constant 
user density by l/a„ so that a u corresponds to a distance (it can be shown that for 
large L, a u /2 is the average distance between the origin and the point Ui closest to the 
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origin). We will have in this case: 




(4) 



For the traffic model, we will generalize the assumption made for the linear chain 
QKD network model: the traffic between any pair of QKD users will be seen as an 
aggregate volume of calls (expressed in units of secret key exchange rate). The volume 
of traffic will be assumed to be the same between any pair of users, and will be denoted 



QKD networks with or without a hierarchical architecture 

As was discussed in section El it is interesting to study to which extent deploying a 
structure such as a backbone, which is synonymous to the existence of hierarchy in a 
network, would be advantageous in the case of QKD networks. To this end, continuing 
to place ourselves in the perspective of cost optimization, we will derive cost functions 
for QKD network models with or without a quantum backbone. The obtained results 
will then allow us to establish comparisons and thus discuss the interest of hierarchy in 
quantum networks. 

3.4- Cost function for a two-dimensional network without backbone: the generalized 
QKD chain model 

A direct way to generalize the two-user one-dimensional chain model presented in 
section 13.21 is simply to assume that a chain of QKD links and intermediate nodes 
will be deployed between each pair of users u and v within the QKD network. Each 
chain will therefore be dimensioned in order to accommodate a volume V of calls. The 
routing of calls is trivial on such a network. The distance between the intermediate 
nodes on a chain will be denoted by £, as in section 13 .21 

Here as well, we neglect the effects of discretisation, i.e. the length of the chains, 
| \u — v\ |, will be considered much longer than the length of individual QKD links, £, and 
the traffic volume V will be considered a continuous quantity. Under these assumptions, 
we know that the cost associated with a pair of users located respectively at positions 
u and v and exchanging a volume V of calls is (see equation (DO)) 



Recall that the distribution of users is described by a Poisson point process 
II = {Ui}. Then, we can calculate the average total cost of the QKD network, C, by 
summing up the costs C ps -"(Uk,Ui) associated with the QKD chains deployed between 
each pair of users over k ^ I and then average this sum over the stochastic user point 
process II: 



by V. 



C pair ( M , v) = V\\u-v\\ C{£)/e + (\\u- v\ \/£)Q 



node 



(5) 



C = E Y^^^Ui) 
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E J2v\\U k -U l \\C(£)/e+ WUk-U^C^ 

= (VC(£)/£ +C nodc /£)6 , (6) 
where 5 is the average sum of distances over all pairs of two different users, namely 



E 



(7) 



J2w u *- U i 

For a homogeneous Poisson point process IT with spatial density of users a~ 2 over a 
square domain D of size L x L, it is possible to perform the exact integral calculation 
of 5, yielding 



1 2-1- /2 

5 = 7 L 5 /at with 7 = - log(l + V2) + ^ ~ 0.5214 . 

5.5. Cost function for a two-dimensional QKD network with backbone 



(8) 



The backbone architectures we will consider in this work are topological: for a given 
distribution of QKD nodes, which will be either deterministic (section 13.6. II) or stochas- 
tic (section 13.6.21) . the backbone cells and backbone links will strictly coincide with the 
Vorono'i cells and the edges of the corresponding Delaunay graph defined above, respec- 
tively. 



Routing traffic over a QKD backbone network 

The backbone hierarchical structure provides a convenient way to solve the routing 
problem that we have adopted in our cost calculations. For a given origin-destination 
pair of users (A,B) wishing to exchange a volume of calls Vab, the traffic is routed in 
the following way: 

• The traffic goes from A to its nearest QKD backbone node Xa (center of the 
backbone cell containing A), through a single QKD link (an access link). 

• The traffic is routed through the optimal (less costly) path over the backbone 
QKD network from Xa to Xb (QKD node closer to B). 

• The traffic goes from Xb to B. 

The routing rule defined above can be characterized as geographical, in the sense 
that it is driven by distance considerations. However, determining the optimal path in a 
given backbone network of arbitrary topology may not be a tractable problem. Even in 
standard networks, where the optimal path is the shortest one, an analytic computation 
of the average length/cost is not always possible. In the context of backbone nodes 
distributed as a Poisson point process, an alternative suboptimal routing policy, the so 
called Markov path, has been proposed, and leads to analytic computation of the average 
path length. In QKD networks, the cost is a non-linear function of the length and some 
adjustments are required. We consider two different geometries for the backbone: 
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(i) A square backbone QKD network (section 13.6.11) . i.e. a regular structure where 
nodes and links form a regular graph of degree 4. In this case finding the length 
of the shortest path between two nodes is trivial: backbone nodes Xa, Xb can be 
designated by cartesian coordinates (xa,Va), (xb,Vb) an d the shortest path length 
is simply \xa~ %b\ + \va — Vb\- Moreover, cost calculations are simplified using the 
fact that the links between two neighbor nodes of the backbone all have the same 
length. 

(ii) A stochastic backbone network (section 13.6.21) . where backbone nodes are dis- 
tributed following a random point process and backbone cells are the corresponding 
Voronoi partition. For this stochastic backbone, we have used a routing technique 
called Markov-path routing for which, as previously established by Tchoumatchenko 
et al. [2J|,[25], the average length of routes can be calculated. In the following, we 
will adapt these calculations to our cost function C(£). 



Generic derivation of the cost function for QKD backbone networks 
For a QKD network with a backbone structure, we define M = {Xi} as the point process 
of the network node distribution, and II = {U{\ as the point process of the network user 
distribution, with intensity density /. Each node Xi is connected to some nodes in its 
neighborhood and to the clients belonging to the associated cell Di. In the following, 
we will assume that M is statistically independent of II, and that the cells Di are the 
Voronoi cells associated to M, that is 



Di 



x : \\x — Xi\\ < inf \\x — Xj 



(9) 



C p ^(u,v;M) 



In the case of the QKD backbone network, our routing policy allows to calculate 
C pair («, v; M), the QKD equipment cost associated with sending one unit of call between 
users u and v, over a network whose backbone nodes are described by the point process 
M: 

' CiWu-XS + CiWv-XiW) 
if u, v G Di 
C(\\u -X i \\) + C(\\v - Xj\\) + C^(i, j; M) 
if u G Di and v G Dj with i ^ j , 

where C{£) is the cost spent to send a secret bit on a QKD link over a distance £ and 
C hop (i, j; M) is the cost to send a secret bit between the nodes Xi and Xj of the backbone 
for the given routing policy. 

Given that the volume between each pair of users is V, the average total cost C of 
the QKD network then reads 



C = C QKD + C 



V x E 



Cnodc X 2 



J2c^(U k ,Uf,M) 

where N 2 is the average number of nodes of the backbone deployed in the domain D of 
size L x L. Here E denotes the average cost over the spatial distributions of users and 
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backbone nodes, that is over the realizations of II and M. Since M and II are supposed 
independently distributed, we may compute this average successively with respect to M 
and II. The total cost, averaged only over II, can be decomposed as follows: 



E 



J2c paiI (U k ,U i; M) 



C p ^(u,v;M) f(u) f(v) dudv 
= E / {C(\\u-X k \\)+C(\\v-X k \\)} f(u)f(v)dudv 

k JD k xD k 

+ E / ~ X k\\) + C{\\v -X l \\) + C^(k, I; M)} f(u) f(v) dudv 

= EE / {CiWu-X.lD + Cdlv-X^)} f(u)f(v)dudv 

k x JD k xD t 

+ V / C hop (k,l;M) f(u) f(v)dudv 

u^r JD k xD, 



As we can see from the last expression, the total cost C can be separated in three terms: 

C =: C loc + C bb +C nodc , (10) 

where C loc takes into account all connections from one client to the closest backbone 
node, C hb all connections from one backbone node to another, and C nodc is the cost of 
node equipment. The explicit models that we will study will allow us to compare the 
behavior of these different terms and thus to understand how QKD network backbone 
topologies can be optimized. 



3. 6. Cost calculations for two explicit quantum backbone models 
3.6.1. Cost of the square backbone QKD network 



Network model: We consider, as a first simple example, the case of a QKD backbone 
network that has a perfectly regular topology, and for which the shortest path length 
between two backbone nodes is easily determined. 

The architecture we consider is the following: users are distributed as previously 
over a large area D of size L x L and the backbone QKD network is a regular graph 
of degree 4, i.e. the backbone QKD nodes and links constitute a square network. 
The structure of the square backbone QKD network and the way a call is routed is 
summarized on figure HI The free parameter with respect to which we will perform the 
cost optimization is the size of backbone cells a bb . We will also make the assumption 
that the user density function / is uniform over D. 



Computation of C bb for the square network: We set X k = ka bb and D k = Xj, + 
a bb [-l/2, 1/2] 2 with k e Z 2 and, for all k ^ I, 

C hop {k,l;M) = ||ife-Z||i(7(a bb ) . 
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L 



Figure 4. Structure of a two-dimensional regular square backbone network: a regular 
array of cells of dimension a bb spans a region of size L x L. The user distribution is 
described by a random point process. In each cell, a central node collects all the local 
traffic. Every user in the cell is thus connected via a QKD link to the central node 
of its cell. On top of this array of cells, a backbone network connects first-neighbor 
QKD nodes with a QKD trunk. Traffic on the backbone network is routed trough the 
shortest path. The dotted blue line describes the path followed for the communication 
between two users A and B (see text for more details). 

Here, ||A; — /||i corresponds to the number of hops between X k and Xi and C(a bb ) to the 
per bit cost of one hop. 

Calling ^ the average number of QKD users in a backbone cell i, we have: 

C hh = Vj2^iC bop (k,l;M) (11) 

k^l 

Hence, 

C bb = VC(a hh ) /x T I> , 

where /j, is the column vector with entries /it, 6 Z 2 , and T is the Toeplitz array indexed 
on Z 2 with entries I\/ = \\k — l\\i. 

Since the density of users / is constant and equal to a on its support D, where 
D '■= Ufce{o N-i} 2 Dk, is the same for all cells D k : fi k = fi/N 2 , with iV 2 denoting 
the total number of backbone cells, and \i = (L/a u ) 2 the mean number of users over D 
(see equation (TJJ). Hence, we find 

C bb = VC{a bb ) fi 2 /N* II k ~ 1 II i • 

fc,«e{o,...,7V-i} 2 
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Now, we compute 

Af-1 Af-1 2 

E ii*-*= E E Ei*. -'.i 

fc,;<E{0,...,Af-l} 2 k 1 ,h=0k 2 ,h=0 i=l 

Af-1 Af-1 Af-1 

fci,«i=0fc 2 ,/2=0 fc,i=0 
Af-1 Af-1 

= AN 2 ^^|fc-Z|=4jV 2 

fe=0 i<fc fc=0 Z<fc 

3 

where the asymptotic equivalence holds as N — > oo. Using iV ~ L/a hh and equation (0J, 
we obtain, as iV — > oo, 

C- ~v£ 4 C M 2 -NS= 2 - ^4«,Vi. (12) 

In the latter expression, we have four multiplicative terms: 

(i) 2/3, a constant depending only on the dimension and the geometry of the backbone 
network (for a cube of dimension d, we could generalize our calculation and would 
find d/3); 

(ii) C(a bb )/a hh , a cost function depending only on the distance a bb between the nodes 
of the backbone; 

(iii) fj, 2 V, the square of the mean number of users times the volume of call per pair of 
users, i.e. in our communication model, the total volume of the communications 
over which the total cost is computed; 

(iv) L, the size of the support of /, that is of the domain where the users lie. 

To understand better the derived expression for C bb , it is interesting to compare 
it with C loc and C llodc . Indeed, we can show that C loc ~ /i 2 C, where C stands for the 
per-bit cost function C averaged over one cell. In the case of the square network with 
«bb x «bb square cells, these cells are contained between two circles of radius a bb /2 and 
ctbb v^2/2 < a bb . Since C is an increasing function of distance we have C < C(a bb ), and 
we can thus derive the important following property: In the limit of large networks, 
i.e. for L 3> a bb , the backbone cost is dominant over the local cost. We will see 
in the following section that this property is preserved for a backbone with randomly 
positioned nodes and an appropriate routing policy. Furthermore, we will see that for 
large L, the backbone node equipment cost C nodc is negligible. Therefore, to optimize the 
cost (equation [TO]) , we only need to minimize C bb . Assuming a square regular backbone, 
this means choosing a bb so as to minimize C (a bb ) / a bb , exactly as in the case of the linear 
chain QKD network model of section 13.21 

Hence, if we take C(t) = C( ^ j D e £ / A Q KD ; the cost is minimized for 

«r = a Q ko . (13) 
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3.6.2. Cost calculation for a stochastic QBB with Markov-path routing 



We now compute C loc and C bb in the case where the routing policy is the so called 
Markov path, as proposed in [25] , where some general formulae are given for computing 
average costs in a general framework (see also |24j). The routing policy is defined 
as follows. First, all pairs of nodes whose cells share a common edge are connected. 
The corresponding graph is a Delaunay graph. Next, given two users A and B with 
respective positions u and v, we define a finite sequence of the nodes X ko , X kl , . . . , X kn 
in the successive cells encountered when drawing a line from u to v. This routing policy 
is illustrated on figure [31 

By definition, X ko and X kn are the centers of the cells containing u and v 
respectively and 



V x 



>DxD 

,2 , loc 



E [C{\\u - X ka \\) + C{\\v - Xfc.ll)] f{u) f(v) dudv 

V k 1oc , (14) 

where fi := J f is the average total number of users and, by stationarity of the point 
process M, 



k 1 ° c = E [C(\\u - X ko \\)] + E [C(\\v - X k 



2E[C(||X ||)] 



with Xq defined as the center of the cell containing the origin. Note that k 1oc denotes the 
average local cost per secret bit and per pair of users. If M is a Poisson point process 
with intensity a~ b 2 , we further have 



X \\ >t)= P(#{X fc : ||X fc || < t} = 0) = exp(-7rt 2 a 



2 ) 

bb I 1 



and hence 



Anal 



C(t) t exp(—irt 2 a b ^)dt = An I C(a hb u) u exp(—nu 2 )du . (15) 



For C bb , we can write 



C h 



V x 



E 



DxD 



Xu. 



i=l 



f{u) f(v) du dv . 



Applying [251 Theorem 2] or the results (in particular Theorem 2.41 and Remark 2.4.2) 
in section 2.4 of |24| (as done in Corollaries 2.5.1 and 2.5.2 in EH), we obtain 



E 



i=l 



K bb \\u-V\ 



where 

K bb ■= 2a" 1 I C(2a bb rsin({^-0}/2)) {cos(0) - cos(^)} r 2 e~ nr2 dip d<f> dr , (16) 

J {r,ip,<f>)<=A 

and A = R + x {(-0, 0) : < |0| < ip < n}. Finally we find that 

C hh = Vn hh 5, (17) 
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where 5 is the average total distance between two different users defined in equation fl7|) 
and computed in equation (jSJ), and ft bb denotes the average backbone cost per secret bit 
and per length unit of the distance separating a pair of users. 

From equations (fTOl . (fT4"|) and (fT7|) . and observing that here the average total 
number of backbone cells N 2 = (L/a bb ) 2 , we find 

C =: C loc + C bb + C nodc = Vx [/iV oc + 5K bb ] + C mde (L/a hh ) 2 , (18) 

where fi 2 and 5 are related to the spatial distribution of the users, and ft loc and ft bb 
are constants related to the geometry of the backbone and to the routing policy. For 
users uniformly distributed in a square of side length L with intensity a~ 2 , we have 
fi 2 ~ (L/a u ) 4 and 5 ~ L 5 /c/. 

Using (f!5l) . ( Till . ( TT8T) and the above approximations of /i 2 and 5, we see that the 
total cost C only depends on L, a u and a bb . Now, for given a u and L, we take a bb so that 
C is minimized and examine which term in the right-hand side of ( f!8l) dominates the 
total cost C as L — > oo in this context. To this end, we first study each term separately. 
We let c denote a constant not depending on L, a bb in the following reasoning. Observe 
that since C is convex and increasing, C(£) > c x i. Using this in ffT5l) and in ([16]) , 
we get C loc > ca bb L 4 and C bb > cL 5 , respectively. Concerning the last term, we have 
Qnode w c L 2 /a 2 hh . It follows that at fixed L, C loc ->• oo as a bb oo and C nodc oo as 
«bb ~~ > 0, from which we can deduce that the optimal a bb stays away of and oo. Now, 
clearly, if a bb stays away from and oo, the above bounds show that C bb dominates as 
L — > oo. Hence, for large L, the optimal intensity a bb is the one that minimizes C bb 
or, equivalently, n bb . To find this optimal intensity, the following result is useful for an 
exponential cost C(£) = ^p e ^ A( 3 KD : 

Lemma 3.1 Define K bb as in equation with C(£) = ^^ e l / x ^ KD . Then the 

following analytical formula holds 



A 

_ n d-1 \-i 
ft — ^qkd^o a qkd 

71 



e <l^% KD ) { i + erf (a bb /(V^\ Q Ko))} + \ QKD /a h 



where 



2 f x _ 2 
erf(x) = —= / e * dt . 

Jo 

Proof. Let s = A QKD /ctbb- We have 

exp (2s~ 1 r sin({-^ — 0}/2)) {cos(0) — cos(ip)} r 2 e _7rr dipd(J)dr 



(r,if>,<j>)eA 

it/2 



8 / / exp(2s _1 r sin(f ) — nr 2 ) r 2 sin(f ) dv dr. 

Jv=0 Jr=0 



Integrating with respect to r yields 



ft — CciKnRr, X 



X 



QKD-'l'O X QKD 

2 4s r /2 



7T 7T 



sin(i;){l + 2 sin 2 (t>)/(7rs 2 )} exp(sin 2 (t>)/(7rs 2 ))(l + erf (sin(t>)/(\/7rs) dv 

v=0 
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Further computations yield 



= C QKD R«%^- le^il +erf(l/( a V5F))} 

7T 



which is the desired expression. 



Using Lemma 13.11 the a hh minimizing n hb , denoted as a* below, can easily be 
calculated using a numerical procedure. We find 

<*« 1.2490 A QKD . (19) 

This result should be compared with the result of equation ffl3|) . where the backbone 
geometry is deterministic and also characterized by the node intensity l/o^ h . The two 
results show that the choice of the backbone and routing policy does influence the 
optimal node intensity, albeit in a modest way. 



3. 7. From cost optimization results to QKD network planning 

Matching QKD network topology with QKD links optimum working distance 
The calculations in sections 13.6.11 and 13.6.21 point to one common result: it appears 
that, for large networks, the costs associated with the QKD devices that have to be 
deployed in backbone nodes to serve the demand are always dominant over the local 
costs, associated to the end connections between QKD users and backbone nodes. 

Moreover, the optimization of backbone costs indicates that minimum cost will be 
reached when the typical distance between backbone nodes is of the order of A QK d, the 
scaling parameter of the curve R(l). 

These results lead to the following statements: 

• When a QKD network deployment is planned, is seems optimal to choose the 
location of network nodes so that QKD links will be operated over distances 
comparable to the optimal distance £ opt . As we have seen in our different models, 
£ opt is always lower bounded by a pre-factor times A QKD . Indeed, when the total cost 
of node equipment can be neglected compared to the cost of QKD devices, as it is 
the case for large networks, then the optimum distance £ opt is indeed comparable 
to A QKD , which is roughly equal to 20 km. This indicates that current QKD 
technologies, for which .D max is already significantly larger than 20 km, are well 
suited for metropolitan operation. On the other hand, the typical distance between 
amplifiers, in optical wide area networks, is of the order of 80 km. If we wanted 
to deploy trusted QKD networks with the current generation of QKD devices, the 
QKD links would have to be operated close to their maximum distance, where 
the unit of secret bit rate becomes very expensive. Although technically already 
feasible, the deployment of wide area QKD networks thus remains a challenge. We 
can however anticipate that this challenge will be overcome within the next years, 
as new generations of QKD protocols and devices, able to generate keys at higher 
rates, and with larger maximum distances are already being presented [26 1 l27l 128] . 
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• The results on cost minimization that we have obtained could provide some helpful 
guidelines for QKD device developers: they may help promoting the idea that what 
will really matter, in the perspective of real network deployment, will be to focus 
on the optimization of their systems around typical network-optimum working dis- 
tances. Optimizing QKD devices in this regime means reducing the cost of a unit 
bit rate at a reasonable distance, where the throughput of the QKD link is not 
considerably smaller than Rq. It will be of course always profitable to design QKD 
devices that can reach very long distances, but as discussed in [29], from a system 
development point of view it can be significantly different to optimize QKD devices 
to reach the longest possible distance -D max , and to optimize them so that the cost 
of unit of bit rate is as low as possible, around the distance £° pt minimizing network 
costs. 



In which regime are backbones useful? 

We would like now to use our calculation results to analyze in which regime QKD 
backbones become economically interesting, i.e. under which conditions it is interesting 
to introduce some hierarchy and resource mutualization in QKD networks, in order to 
decrease the total deployment cost. 

In the previous sections we have performed cost calculations that can be used to 
establish some quantitative comparisons between: 

• The cost of a QKD network with no hierarchy as in the generalized linear chain 
QKD network, whose cost calculations have been performed in section l3~4l 

• The cost of a QKD network with one level of hierarchy, which is the case of the 
square backbone QKD network studied in section 13.6.11 

Since these two cost calculations have been performed under the same assumptions 
regarding user distribution and traffic demand, we can use the results given in 
equations (jSJ) and (fT2l) to compare the total network deployment costs, respectively 
for the generalized linear chain model and for a QKD network with a square backbone 
(for which we have seen that we could neglect the cost of the local access network). 

The condition under which it will be more cost effective to deploy a quantum 
backbone than to connect all pair of users by one- dimensional chains of QKD links can 
be described by the following inequality between the respective optimal costs 

/"Jopt, chain \ /^opt, square 
^D, chain — ^D, square 

& (V C(f pt )/f pt + C no Jt^ja 2 L 5 > 1 C(«r)/«r ° 2 L 5 V + C nodc L 2 /a° b f (20) 

The above equation is not very convenient to handle because in general ^ £ opt . 
However, 

^Jopt, chain ^ ^Jopt, square v ^Jopt, square \, ^Jopt, square f 2 1 1 

2D, chain — 2D, square 2D, chain — 2D. square V / 

Thus, we can derive a necessary condition under which the deployment of a 
backbone for a QKD network is a better solution than a design that would solely rely 
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on the generalized linear chain of QKD links to transport the traffic: 

^:zr > QC q ;r & c nodc (^7- 1) > cKr)^ 2 £ 3 < (jj - 7) 

4* C node (a 2 /a* 2 - 1) > C(aX) V a 2 /a* 2 (2- - 1) (22) 

37 

with a* = l/VL 3 Q b T7 • 

Keeping in mind that ^ — 1 is a positive number, we can use the last inequality to 
make the following observations: 

• First, it appears that, if the user density a is smaller than a*, which we can 
qualify as a critical user density, then equation ( 1221) can never be verified. This 
means that below o* it will never be interesting to deploy a backbone. This result 
has a clear interpretation: backbone infrastructures can only be interesting in the 
case where sharing resources offers a cost reduction. And the incentive to share a 
backbone infrastructure can only exist if there are enough users. The minimum total 
number of users required to have a cost incentive towards backbone deployment is 
a*L 2 = v/L/( 7 «r). 

• In case a is larger than the critical user density a*, we enter a regime where there 
will be an incentive to deploy a quantum backbone essentially if the cost of a node 
C nodc dominates over the cost of QKD link equipment to be deployed, which scales 
as C{a°fo)V . This also has a clear interpretation: if we take the extreme case where 
building a node (and installing node equipment inside it) is zero, we can foresee that 
there will be no incentive to build a backbone: it will always be cheaper to deploy 
direct chains between each pair of users. The motivation to build a backbone arises 
when efforts associated to opening a QKD node are important. This will of course 
be the case if QKD node equipment is expensive, as we can see from equation ( J22l . 
but it is also intuitive that, in case significant efforts are required to build new QKD 
nodes, mutualization of nodes through a backbone structure will be a cost effective 
solution. 

4. Conclusion and Perspectives 

In this paper, we performed a topological analysis of quantum key distribution networks 
with trusted repeater nodes. In particular, under specific assumptions on the user and 
node distributions as well as the call traffic and routing in such networks, we derived 
cost functions for different network architectures. We first considered a linear chain 
network as a basic model that served the purpose of illustrating the main techniques 
and ideas that we used, and then moved on to more advanced network configurations 
that were in some cases enhanced with a backbone structure. Using cost minimization 
arguments, we obtained results on the optimal working points of QKD links and spatial 
distribution of QKD nodes, and examined the importance of introducing hierarchy into 
QKD networks. 
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Our results indicate that, in the context of QKD networks, it is more cost-effective 
and therefore advantageous to operate individual QKD links at their optimal working 
point, which is in general significantly shorter than the maximum span of such links. 
This conclusion motivates the research of new experimental compromises in practical 
QKD systems, and can be illustrated by considering examples of such systems where the 
characteristics of either a hardware component (for example a single-photon detector) 
or a software algorithm (for example a reconciliation code) can be experimentally 
manipulated function of distance [29] . 

In general, it is clear that, as the realization of more and more advanced QKD 
networks approaches the realm of actual deployment, it becomes necessary to orient 
the research on QKD devices and links towards cost-related directions, and extend 
the techniques we have presented here to more sophisticated network technologies and 
architectures. 
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